phase2-firelightfi[.]xyz

Analysis of phase2-firelightfi.xyz conducted on 26 July 2026 shows the domain was registered on 25 July 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative name servers are kip.ns.cloudflare.com and meera.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS service. DNS resolution points to IP address 104.21.79.202, a Cloudflare edge node that is frequently leveraged by malicious operators to hide origin infrastructure. The domain appears on a single security blocklist, PhishDestroy, which categorises it as a generic phishing site. VirusTotal reports that eight of ninety‑one scanning engines have flagged the domain, providing independent corroboration of malicious intent.

The domain remains active at the time of analysis; no evidence of takedown or sink‑hole redirection is observed. Publicly available metadata does not include a page title, SSL certificate details, HTTP status codes, or Safe Browsing verdicts, leaving the exact visual content and payload unknown. Consequently, the precise phishing lure, target brand, or credential‑ harvesting mechanism cannot be confirmed without direct content inspection. Nevertheless, the combination of recent registration, Cloudflare hosting, blocklist inclusion, and multi‑engine detection constitutes a high‑confidence indicator of phishing activity.

Defenders should add phase2-firelightfi.xyz to blocklists and URL filtering policies, enforce DNS sink‑hole or NXDOMAIN responses, and monitor outbound connections to its IP address 104.21.79.202. Network traffic analysis for TLS handshakes to Cloudflare edge nodes may help identify associated command‑and‑control or data‑exfiltration flows. Continuous re‑scanning on VirusTotal and other sandboxes is recommended to capture any evolving payloads or changes in hosting. Organizations using threat‑intelligence feeds should prioritize alerts for this domain given its high risk rating and active status.